NIS2 and your AI stack: who answers when an agent acts?

The NIS2 directive widened Europe's cybersecurity net from a few hundred operators to tens of thousands of "essential and important entities" — and it moved liability upward: management bodies must approve cybersecurity risk measures and can be held personally accountable for gross negligence. That changes the AI conversation. An autonomous agent that reads tickets, drafts emails and calls APIs is not a productivity tool in NIS2 terms; it is part of your attack surface and your supply chain at once.

Three questions your NIS2 auditor will ask about AI

• Who authorised this agent, and to do what? A prompt is not an authorisation. You need a durable record of which tools an agent may call, with what budget, in which scope — and proof it cannot exceed that authority.
• What happens when it is compromised? Prompt injection is the supply-chain attack of the AI era. Article 21 expects documented measures against exactly this class of incident — and evidence that a hijacked input cannot become a hijacked action.
• Can you show the trail? Incident reporting windows under NIS2 are brutal — early warning within 24 hours. If your AI activity is scattered across SaaS logs you do not control, you cannot reconstruct events in time.

The architectural answer

Governance that lives in policy documents fails these questions; governance that lives in the execution path passes them. Signed agent authority contracts enforced on every run, a two-gate defense that vets content and actions independently, default-deny egress on every connector, and an append-only audit ledger no administrator can rewrite — these turn NIS2 answers from an archaeology project into a database query.

The practical checklist

• Inventory every place an AI system can take an action, not just answer a question.
• Bind each agent to an explicit, revocable authority: tools, budget, scope, expiry.
• Demand fail-closed behaviour where safety is at stake, and truthful status when it is not enforcing.
• Keep the evidence inside your perimeter — the regulator will not accept "our vendor has the logs."